[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWASVCY6RBMKGF53P1W43":3,"skill-same:01M6AFWASVCY6RBMKGF53P1W43":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6AFWASVCY6RBMKGF53P1W43","korea-pipa",null,"Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fkorea-pipa\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[27,28,29,30,31,32,33,34,35],"korea pipa","personal","framework","transfer","compliance","data protection","privacy","data","data-protection","2026-11-10 10:12:30",false,"---\nname: korea-pipa\ndescription: >-\n  Guides compliance with South Korea's Personal Information Protection Act (PIPA,\n  개인정보 보호법). Covers pseudonymisation framework, notification requirements,\n  PIPC enforcement, consent standards, and cross-border transfer rules under the\n  2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation,\n  consent, cross-border transfers.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: global-privacy-regulations\n  tags: \"pipa, korea-data-protection, pipc, pseudonymisation, cross-border-transfers\"\n---\n\n# South Korea PIPA Compliance\n\n## Overview\n\nThe Personal Information Protection Act (PIPA, 개인정보 보호법) is South Korea's comprehensive data protection law, originally enacted on 29 September 2011 (Act No. 10465) and significantly amended in 2020 (effective 5 August 2020) and 2023 (effective 15 September 2023). The Personal Information Protection Commission (PIPC, 개인정보보호위원회) is the independent supervisory authority with centralised enforcement jurisdiction since the 2020 amendments consolidated regulatory authority from multiple agencies.\n\nSouth Korea received an adequacy decision from the European Commission on 17 December 2021, recognising PIPA as providing an adequate level of data protection for GDPR transfer purposes.\n\n## Scope and Definitions\n\n### Personal Information (Art. 2(1))\nInformation relating to a living individual that identifies or can identify the individual through the information alone or in combination with other information that can be easily used. Includes:\n- Name, resident registration number, image\n- Information that individually does not identify but can identify when combined with other easily accessible information\n\n### Pseudonymised Information (Art. 2(1-2), introduced 2020)\nPersonal information processed by partially deleting or replacing to make it impossible to identify a specific individual without the use of additional information. Pseudonymised information may be processed for statistical purposes, scientific research, and preservation of records in the public interest without consent (Art. 28-2).\n\n### Sensitive Information (Art. 23)\n- Ideology, beliefs, membership of trade unions or political parties\n- Political opinions, health information, sex life\n- Genetic information, criminal record information\n- Biometric information used for identification\n- Race and ethnic origin (added by 2023 amendments)\n\n## Consent Framework\n\n### General Consent Requirements\n\n| Requirement | PIPA Provision | Detail |\n|-------------|---------------|--------|\n| Informed consent | Art. 15(2) | Must disclose: purpose, items collected, retention period, right to refuse and consequences |\n| Separate consent | Art. 22(1) | Consent for processing beyond the purpose must be separated from other consent items |\n| Clear distinction | Art. 22(1) | Important content must be clearly displayed (larger font, colour, bold) |\n| Opt-in for marketing | Art. 22(2) | Marketing purpose collection requires separate opt-in consent |\n| Refusal right | Art. 22(5) | Data handler must not refuse service due to refusal of consent for non-essential information |\n| Minor consent | Art. 22(6) | For children under 14, consent from legal representative required |\n\n### Consent for Sensitive Information (Art. 23)\nProcessing sensitive information requires the data subject's separate explicit consent or a specific legal basis. The consent must clearly indicate the sensitive categories being processed.\n\n### 2023 Amendment: Consent Alternatives (Art. 15(1))\n\nThe 2023 amendments introduced additional lawful processing bases beyond consent:\n\n| Basis | Article | Description |\n|-------|---------|-------------|\n| Consent | Art. 15(1)(1) | Data subject's consent obtained per Art. 22 |\n| Legal obligation | Art. 15(1)(2) | Special provisions in laws or compliance with legal obligations |\n| Public institution duty | Art. 15(1)(3) | Necessary for public institutions to perform statutory duties |\n| Contract performance | Art. 15(1)(4) | Necessary for contract with data subject |\n| Legitimate interest | Art. 15(1)(6) | Necessary for legitimate interest of the data handler, where substantially related to the purpose and within the data subject's reasonable expectations (added 2023) |\n| Urgent necessity | Art. 15(1)(5) | Urgently necessary for life, body, or property of the data subject or third party |\n\n**Legitimate interest (Art. 15(1)(6)) requirements**:\n- Reasonably related to the interest of the data handler\n- Substantially related to the original collection purpose\n- Within the reasonable expectations of the data subject\n- Data handler must document the legitimate interest assessment\n- The PIPC may issue further guidance on the scope and application\n\n## Pseudonymisation Framework (Arts. 28-2 to 28-7)\n\n### Permitted Uses of Pseudonymised Information (Art. 28-2)\nPseudonymised information may be processed without consent for:\n1. Statistical purposes\n2. Scientific research (including industrial research)\n3. Preservation of records in the public interest\n\n### Combination of Pseudonymised Information (Art. 28-3)\n- Combination of pseudonymised information held by different data handlers must be performed by an entity designated by the PIPC\n- The designated entity must apply additional pseudonymisation or anonymisation before providing the combined data to the requesting handler\n- The combination must receive prior PIPC approval\n\n### Safety Measures for Pseudonymised Information (Art. 28-4)\n| Measure | Requirement |\n|---------|-------------|\n| Separation of additional information | Additional information enabling re-identification must be stored and managed separately |\n| Technical safeguards | Encryption or equivalent protection for additional information |\n| Access restrictions | Designation of authorised personnel; access logging |\n| Prohibition on re-identification | Prohibited from using pseudonymised information to re-identify individuals; if re-identification occurs accidentally, immediate destruction or cessation of processing required |\n\n### Zenith Global Enterprises Pseudonymisation Register\n\n| Data Set | Purpose | Pseudonymisation Method | Additional Information Storage | PIPC Compliance |\n|----------|---------|------------------------|-------------------------------|-----------------|\n| Customer shipping patterns | Statistical analysis of route optimisation | k-anonymity (k=5) with generalisation of location data | Key mapping table stored in HSM, separate from analytics environment | Compliant |\n| Employee performance metrics | Industrial research on workforce productivity | Tokenisation of employee identifiers | Token-identifier mapping in isolated database with MFA access | Compliant |\n| Logistics volume trends | Public interest statistical reporting | Aggregation to postal code level with suppression of groups \u003C 10 | No additional information retained (anonymised output) | Not applicable (anonymised) |\n\n## Cross-Border Transfer Rules\n\n### Transfer Mechanisms (Art. 28-8, as amended 2023)\n\nThe 2023 amendments significantly reformed cross-border transfer provisions:\n\n| Mechanism | Article | Detail |\n|-----------|---------|--------|\n| Consent | Art. 28-8(1)(1) | Data subject's consent with disclosure of: recipient, destination country, transfer purpose, PI items, right to refuse and consequences |\n| Contract necessity | Art. 28-8(1)(2) | Transfer necessary for contract with data subject |\n| Adequacy recognition | Art. 28-8(1)(3) | Transfer to a country or international organisation recognised by the PIPC as having adequate protection |\n| Standard contractual clauses | Art. 28-8(1)(4) | PIPC-approved standard contractual clauses between the parties |\n| BCR equivalent | Art. 28-8(1)(4) | PIPC-approved data protection rules within a corporate group |\n| PIPC certification | Art. 28-8(1)(5) | Recipient certified by a PIPC-designated certification body |\n\n### PIPC Adequacy Recognitions\nAs of March 2026, the PIPC has recognised:\n- European Union \u002F EEA (reciprocal with EU adequacy decision of December 2021)\n- United Kingdom (recognised 2022)\n\n### Notification Requirements for Cross-Border Transfer (Art. 28-8(3))\nThe data handler must notify the data subject of:\n- The recipient's identity\n- The destination country\n- The items of personal information transferred\n- The purpose of transfer\n- The retention and use period\n- The right to refuse and consequences of refusal\n\n**Zenith Global Enterprises Cross-Border Transfer Register**:\n\n| Transfer ID | Flow | Destination | Mechanism | Notification | Status |\n|------------|------|-------------|-----------|-------------|--------|\n| CBT-KR-001 | Customer data → EU HQ | Germany (EU) | Adequacy recognition | Privacy notice updated | Active |\n| CBT-KR-002 | Employee data → Regional HR | Singapore | Standard contractual clauses | Employee notice provided | Active |\n| CBT-KR-003 | Logistics data → APAC ops | Japan | Consent (Art. 28-8(1)(1)) | Consent collected | Active |\n| CBT-KR-004 | Payment data → Treasury | United Kingdom | Adequacy recognition | Privacy notice updated | Active |\n\n## PIPC Enforcement\n\n### Administrative Penalties\n\n| Sanction Type | PIPA Provision | Detail |\n|---------------|---------------|--------|\n| Corrective orders | Art. 64 | Orders to cease violations, take corrective measures, or implement safeguards |\n| Administrative fines (과태료) | Art. 75 | Up to KRW 50 million for procedural violations |\n| Penalty surcharges (과징금) | Art. 64-2 | Up to 3% of related revenue (increased from prior cap by 2023 amendments) |\n| Criminal penalties | Art. 71-73 | Imprisonment up to 5 years or fine up to KRW 50 million for serious violations |\n| Public naming | Art. 64(4) | Public disclosure of violators |\n\n### Notable PIPC Enforcement Actions\n\n**Meta Platforms (September 2022)**:\n- Fine: KRW 30.8 billion (approximately USD 22 million)\n- Violations: Collecting and using sensitive information (political views, sexual orientation, religious beliefs) without proper consent from approximately 3.3 million Korean Facebook users\n- Significance: Demonstrated PIPC willingness to impose significant fines on global technology companies\n\n**Kakao (2023)**:\n- Fine: KRW 15.1 billion\n- Violations: Collection and use of personal information beyond consented purposes in advertising services\n- Significance: Largest enforcement action against a domestic technology company\n\n**Scatter Lab (2021)**:\n- Fine: KRW 103 million\n- Violations: AI chatbot (Lee Luda) trained on personal conversations without consent\n- Significance: Established PIPC precedent for AI training data compliance under PIPA\n\n## Data Subject Rights\n\n| Right | Article | Response Deadline | Implementation |\n|-------|---------|-------------------|----------------|\n| Right to access | Art. 35 | 10 days | Self-service portal in Korean |\n| Right to correction\u002Fdeletion | Art. 36 | 10 days | Correction through customer portal; deletion workflow with legal hold check |\n| Right to suspension | Art. 37 | 10 days | Processing suspension within 10 days of request |\n| Right to notification | Art. 34 | Without delay | Breach notification to affected individuals |\n| Right to data portability | Art. 35-2 (2023) | Per PIPC regulation | Structured export (implementation timeline per PIPC guidance) |\n| Right regarding automated decisions | Art. 37-2 (2023) | Per PIPC regulation | Right to explanation and refusal of automated decisions |\n\n## Breach Notification (Art. 34)\n\n| Element | Requirement |\n|---------|-------------|\n| Individual notification | Without delay upon discovery of breach |\n| PIPC notification | Within 72 hours of discovery for breaches affecting 1,000+ individuals |\n| Content | Facts of breach, items of PI leaked, countermeasures, grievance procedures |\n| Large-scale breach | 10,000+ individuals: additional reporting to PIPC and public notification through the website |\n| Investigation cooperation | Cooperate fully with PIPC investigation |\n\n## Compliance Programme\n\n| Component | Detail |\n|-----------|--------|\n| Internal management plan | Documented plan per Art. 29 and Enforcement Decree Art. 30 |\n| Chief Privacy Officer (CPO) | Designated officer meeting PIPA qualifications (Art. 31) |\n| Annual training | PIPA compliance training for all Korean employees |\n| Technical safeguards | Encryption of resident registration numbers and sensitive data (Art. 24-2) |\n| Data destruction | Destruction within 5 days of retention period expiry (Art. 21) |\n| Privacy impact assessment | Required for public institutions; recommended for private sector for large-scale processing |\n","# South Korea PIPA Compliance\n\n## Overview\n\nThe Personal Information Protection Act (PIPA, 개인정보 보호법) is South Korea's comprehensive data protection law, originally enacted on 29 September 2011 (Act No. 10465) and significantly amended in 2020 (effective 5 August 2020) and 2023 (effective 15 September 2023). The Personal Information Protection Commission (PIPC, 개인정보보호위원회) is the independent supervisory authority with centralised enforcement jurisdiction since the 2020 amendments consolidated regulatory authority from multiple agencies.\n\nSouth Korea received an adequacy decision from the European Commission on 17 December 2021, recognising PIPA as providing an adequate level of data protection for GDPR transfer purposes.\n\n## Scope and Definitions\n\n### Personal Information (Art. 2(1))\nInformation relating to a living individual that identifies or can identify the individual through the information alone or in combination with other information that can be easily used. Includes:\n- Name, resident registration number, image\n- Information that individually does not identify but can identify when combined with other easily accessible information\n\n### Pseudonymised Information (Art. 2(1-2), introduced 2020)\nPersonal information processed by partially deleting or replacing to make it impossible to identify a specific individual without the use of additional information. Pseudonymised information may be processed for statistical purposes, scientific research, and preservation of records in the public interest without consent (Art. 28-2).\n\n### Sensitive Information (Art. 23)\n- Ideology, beliefs, membership of trade unions or political parties\n- Political opinions, health information, sex life\n- Genetic information, criminal record information\n- Biometric information used for identification\n- Race and ethnic origin (added by 2023 amendments)\n\n## Consent Framework\n\n### General Consent Requirements\n\n| Requirement | PIPA Provision | Detail |\n|-------------|---------------|--------|\n| Informed consent | Art. 15(2) | Must disclose: purpose, items collected, retention period, right to refuse and consequences |\n| Separate consent | Art. 22(1) | Consent for processing beyond the purpose must be separated from other consent items |\n| Clear distinction | Art. 22(1) | Important content must be clearly displayed (larger font, colour, bold) |\n| Opt-in for marketing | Art. 22(2) | Marketing purpose collection requires separate opt-in consent |\n| Refusal right | Art. 22(5) | Data handler must not refuse service due to refusal of consent for non-essential information |\n| Minor consent | Art. 22(6) | For children under 14, consent from legal representative required |\n\n### Consent for Sensitive Information (Art. 23)\nProcessing sensitive information requires the data subject's separate explicit consent or a specific legal basis. The consent must clearly indicate the sensitive categories being processed.\n\n### 2023 Amendment: Consent Alternatives (Art. 15(1))\n\nThe 2023 amendments introduced additional lawful processing bases beyond consent:\n\n| Basis | Article | Description |\n|-------|---------|-------------|\n| Consent | Art. 15(1)(1) | Data subject's consent obtained per Art. 22 |\n| Legal obligation | Art. 15(1)(2) | Special provisions in laws or compliance with legal obligations |\n| Public institution duty | Art. 15(1)(3) | Necessary for public institutions to perform statutory duties |\n| Contract performance | Art. 15(1)(4) | Necessary for contract with data subject |\n| Legitimate interest | Art. 15(1)(6) | Necessary for legitimate interest of the data handler, where substantially related to the purpose and within the data subject's reasonable expectations (added 2023) |\n| Urgent necessity | Art. 15(1)(5) | Urgently necessary for life, body, or property of the data subject or third party |\n\n**Legitimate interest (Art. 15(1)(6)) requirements**:\n- Reasonably related to the interest of the data handler\n- Substantially related to the original collection purpose\n- Within the reasonable expectations of the data subject\n- Data handler must document the legitimate interest assessment\n- The PIPC may issue further guidance on the scope and application\n\n## Pseudonymisation Framework (Arts. 28-2 to 28-7)\n\n### Permitted Uses of Pseudonymised Information (Art. 28-2)\nPseudonymised information may be processed without consent for:\n1. Statistical purposes\n2. Scientific research (including industrial research)\n3. Preservation of records in the public interest\n\n### Combination of Pseudonymised Information (Art. 28-3)\n- Combination of pseudonymised information held by different data handlers must be performed by an entity designated by the PIPC\n- The designated entity must apply additional pseudonymisation or anonymisation before providing the combined data to the requesting handler\n- The combination must receive prior PIPC approval\n\n### Safety Measures for Pseudonymised Information (Art. 28-4)\n| Measure | Requirement |\n|---------|-------------|\n| Separation of additional information | Additional information enabling re-identification must be stored and managed separately |\n| Technical safeguards | Encryption or equivalent protection for additional information |\n| Access restrictions | Designation of authorised personnel; access logging |\n| Prohibition on re-identification | Prohibited from using pseudonymised information to re-identify individuals; if re-identification occurs accidentally, immediate destruction or cessation of processing required |\n\n### Zenith Global Enterprises Pseudonymisation Register\n\n| Data Set | Purpose | Pseudonymisation Method | Additional Information Storage | PIPC Compliance |\n|----------|---------|------------------------|-------------------------------|-----------------|\n| Customer shipping patterns | Statistical analysis of route optimisation | k-anonymity (k=5) with generalisation of location data | Key mapping table stored in HSM, separate from analytics environment | Compliant |\n| Employee performance metrics | Industrial research on workforce productivity | Tokenisation of employee identifiers | Token-identifier mapping in isolated database with MFA access | Compliant |\n| Logistics volume trends | Public interest statistical reporting | Aggregation to postal code level with suppression of groups \u003C 10 | No additional information retained (anonymised output) | Not applicable (anonymised) |\n\n## Cross-Border Transfer Rules\n\n### Transfer Mechanisms (Art. 28-8, as amended 2023)\n\nThe 2023 amendments significantly reformed cross-border transfer provisions:\n\n| Mechanism | Article | Detail |\n|-----------|---------|--------|\n| Consent | Art. 28-8(1)(1) | Data subject's consent with disclosure of: recipient, destination country, transfer purpose, PI items, right to refuse and consequences |\n| Contract necessity | Art. 28-8(1)(2) | Transfer necessary for contract with data subject |\n| Adequacy recognition | Art. 28-8(1)(3) | Transfer to a country or international organisation recognised by the PIPC as having adequate protection |\n| Standard contractual clauses | Art. 28-8(1)(4) | PIPC-approved standard contractual clauses between the parties |\n| BCR equivalent | Art. 28-8(1)(4) | PIPC-approved data protection rules within a corporate group |\n| PIPC certification | Art. 28-8(1)(5) | Recipient certified by a PIPC-designated certification body |\n\n### PIPC Adequacy Recognitions\nAs of March 2026, the PIPC has recognised:\n- European Union \u002F EEA (reciprocal with EU adequacy decision of December 2021)\n- United Kingdom (recognised 2022)\n\n### Notification Requirements for Cross-Border Transfer (Art. 28-8(3))\nThe data handler must notify the data subject of:\n- The recipient's identity\n- The destination country\n- The items of personal information transferred\n- The purpose of transfer\n- The retention and use period\n- The right to refuse and consequences of refusal\n\n**Zenith Global Enterprises Cross-Border Transfer Register**:\n\n| Transfer ID | Flow | Destination | Mechanism | Notification | Status |\n|------------|------|-------------|-----------|-------------|--------|\n| CBT-KR-001 | Customer data → EU HQ | Germany (EU) | Adequacy recognition | Privacy notice updated | Active |\n| CBT-KR-002 | Employee data → Regional HR | Singapore | Standard contractual clauses | Employee notice provided | Active |\n| CBT-KR-003 | Logistics data → APAC ops | Japan | Consent (Art. 28-8(1)(1)) | Consent collected | Active |\n| CBT-KR-004 | Payment data → Treasury | United Kingdom | Adequacy recognition | Privacy notice updated | Active |\n\n## PIPC Enforcement\n\n### Administrative Penalties\n\n| Sanction Type | PIPA Provision | Detail |\n|---------------|---------------|--------|\n| Corrective orders | Art. 64 | Orders to cease violations, take corrective measures, or implement safeguards |\n| Administrative fines (과태료) | Art. 75 | Up to KRW 50 million for procedural violations |\n| Penalty surcharges (과징금) | Art. 64-2 | Up to 3% of related revenue (increased from prior cap by 2023 amendments) |\n| Criminal penalties | Art. 71-73 | Imprisonment up to 5 years or fine up to KRW 50 million for serious violations |\n| Public naming | Art. 64(4) | Public disclosure of violators |\n\n### Notable PIPC Enforcement Actions\n\n**Meta Platforms (September 2022)**:\n- Fine: KRW 30.8 billion (approximately USD 22 million)\n- Violations: Collecting and using sensitive information (political views, sexual orientation, religious beliefs) without proper consent from approximately 3.3 million Korean Facebook users\n- Significance: Demonstrated PIPC willingness to impose significant fines on global technology companies\n\n**Kakao (2023)**:\n- Fine: KRW 15.1 billion\n- Violations: Collection and use of personal information beyond consented purposes in advertising services\n- Significance: Largest enforcement action against a domestic technology company\n\n**Scatter Lab (2021)**:\n- Fine: KRW 103 million\n- Violations: AI chatbot (Lee Luda) trained on personal conversations without consent\n- Significance: Established PIPC precedent for AI training data compliance under PIPA\n\n## Data Subject Rights\n\n| Right | Article | Response Deadline | Implementation |\n|-------|---------|-------------------|----------------|\n| Right to access | Art. 35 | 10 days | Self-service portal in Korean |\n| Right to correction\u002Fdeletion | Art. 36 | 10 days | Correction through customer portal; deletion workflow with legal hold check |\n| Right to suspension | Art. 37 | 10 days | Processing suspension within 10 days of request |\n| Right to notification | Art. 34 | Without delay | Breach notification to affected individuals |\n| Right to data portability | Art. 35-2 (2023) | Per PIPC regulation | Structured export (implementation timeline per PIPC guidance) |\n| Right regarding automated decisions | Art. 37-2 (2023) | Per PIPC regulation | Right to explanation and refusal of automated decisions |\n\n## Breach Notification (Art. 34)\n\n| Element | Requirement |\n|---------|-------------|\n| Individual notification | Without delay upon discovery of breach |\n| PIPC notification | Within 72 hours of discovery for breaches affecting 1,000+ individuals |\n| Content | Facts of breach, items of PI leaked, countermeasures, grievance procedures |\n| Large-scale breach | 10,000+ individuals: additional reporting to PIPC and public notification through the website |\n| Investigation cooperation | Cooperate fully with PIPC investigation |\n\n## Compliance Programme\n\n| Component | Detail |\n|-----------|--------|\n| Internal management plan | Documented plan per Art. 29 and Enforcement Decree Art. 30 |\n| Chief Privacy Officer (CPO) | Designated officer meeting PIPA qualifications (Art. 31) |\n| Annual training | PIPA compliance training for all Korean employees |\n| Technical safeguards | Encryption of resident registration numbers and sensitive data (Art. 24-2) |\n| Data destruction | Destruction within 5 days of retention period expiry (Art. 21) |\n| Privacy impact assessment | Required for public institutions; recommended for private sector for large-scale processing |\n",{"name":5,"license":15,"metadata":41,"description":7},{"tags":42,"author":9,"domain":33,"version":43,"subdomain":44},"pipa, korea-data-protection, pipc, pseudonymisation, cross-border-transfers","1.0","global-privacy-regulations","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fkorea-pipa",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill korea-pipa",{"tool":60,"command":61},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill korea-pipa",{"tool":63,"command":64},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill korea-pipa","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fkorea-pipa\u002FSKILL.md",true,[68,74,80,84],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md","ASSET","资产文件",4324,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fkorea-pipa\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fstandards.md","REFERENCE","参考文档",6767,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fkorea-pipa\u002Freferences\u002Fstandards.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fworkflows.md",6288,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fkorea-pipa\u002Freferences\u002Fworkflows.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fprocess.py","SCRIPT","脚本",12792,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fkorea-pipa\u002Fscripts\u002Fprocess.py",[91,114,128,141,157,170],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":106,"publishedAt":36},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[97,102,105],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":103,"categoryName":104,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[107,108,33,31,109,34,110,111,112,113],"email","workplace email privacy","content","policy","testing","monitoring","metadata",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":122,"publishedAt":36},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[120,121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[34,123,124,125,31,32,126,33,127],"whistleblower data","identity","reporting","gdpr","prevention",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":36},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,136,137,138,139,126,33,140],"vendor termination data","planning","verification","extraction","certification",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":36},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,150,151,152,153,154,30,155,33,34,156],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","certifications","processor",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":36},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[163],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[33,165,126,166,154,167,168,34,156,150,140,169],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":183,"publishedAt":36},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[176,179,182],{"categoryNo":177,"categoryName":178,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[184,185,33,186,138,187,31,126,188,156,189,190,191,137],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]